CVE-2019-3878

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

• CWE-305
• CWE-287

• https://access.redhat.com/errata/RHBA-2019:0959
• https://access.redhat.com/errata/RHSA-2019:0746Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0766Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0985
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878Issue Tracking, Patch, Third Party Advisory
• https://github.com/Uninett/mod_auth_mellon/pull/196Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/
• https://usn.ubuntu.com/3924-1/Third Party Advisory
• https://access.redhat.com/errata/RHBA-2019:0959
• https://access.redhat.com/errata/RHSA-2019:0746Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0766Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0985
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878Issue Tracking, Patch, Third Party Advisory
• https://github.com/Uninett/mod_auth_mellon/pull/196Exploit, Patch, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/
• https://usn.ubuntu.com/3924-1/Third Party Advisory

Published

Mar 26, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3872It was found that a SAMLRequest containing a script could be…5.4
• CVE-2019-3873It was found that Picketlink as shipped with Jboss Enterpris…6.4
• CVE-2019-3874The SCTP socket buffer used by a userspace application is no…6.5
• CVE-2019-3875A vulnerability was found in keycloak before 6.0.2. The X.50…6.5
• CVE-2019-3876A flaw was found in the /oauth/token/request custom endpoint…6.3
• CVE-2019-3877A vulnerability was found in mod_auth_mellon before v0.14.2.…5.8
• CVE-2019-3879It was discovered that in the ovirt's REST API before versio…8.1
• CVE-2019-3880A flaw was found in the way samba implemented an RPC endpoin…5.4
• CVE-2019-3881Bundler prior to 2.1.0 uses a predictable path in /tmp/, cre…7.8
• CVE-2019-3882A flaw was found in the Linux kernel's vfio interface implem…5.5
• CVE-2019-3883In 389-ds-base up to version 1.4.1.2, requests are handled b…7.5
• CVE-2019-3884A vulnerability exists in the garbage collection mechanism o…5.4